According to the documentation in https://external-secrets.io/v0.9.17/guides/pushsecrets/, PushSecret spec.template exists. However, nothing is copied with a Kubernetes cluster->cluster SecretStore.

External Secrets Operator v0.9.17

To Reproduce
Given the following PushSecret, only the attribute defined in spec.data is copied to the remote Secret.

Nothing from spec.template.metadata.labels or spec.template.data is copied to the remote Secret.

I also tried what happens when spec.data is not present at all: then the remote Secret is not created at all even though PushSecret .status shows message: PushSecret synced successfully.

apiVersion: external-secrets.io/v1alpha1
kind: PushSecret
metadata:
  name: ps-example
spec:
  refreshInterval: 30m
  secretStoreRefs:
  - name: example-store
    kind: SecretStore
  selector:
    secret:
      name: example-secret 
  template:
    metadata:
      labels:
        app.kubernetes.io/part-of: argocd
    data:
      example-1: "{{ .url | toString }}"
  data:
  - match:
      secretKey: url
      remoteRef:
        remoteKey: example-remote-key
        property: url

Expected behavior
The .spec.template should be reflected to the remote Secret.

Related

• PushSecret/Kubernetes: allow cloning of Secrets across clusters #2836
• Support pushing secrets' metadata to providers #3353